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ABSTRACT 



The use of retinal biometric identifiers as security 
devices in shipboard applications was investigated with the 
use of the DOT 7.5(new version) and DAISY 7. 5( old version) 
scanners of the Eye-Dentify Co. of Beaverton, Oregon. Motion 
testing was the primary purpose of the thesis. It was the 
first occurance of dynamic testing on any type of retinal 
pattern recognition device. A transverse motion(only) 
simulator that could roll up to fourteen degrees and sustain 
a cycle per minute(cpm) rate of 6.0 was constructed and 
utilized. The nature of the experiment was to test the two 
scanners to determine if there would be significant 
differences in the characteristics of the two, and their 
possible uses at sea. Important conclusions were: 1) The 
best results occured on the DOT 7.5, although five Type II 
'RECOGNITION' errors were noted; 2) As period of roll and 
angle of roll were increased in cpm's and degrees 
respectfully, results were poorer; 3) Identification 
threshold settings were allowed to be set too low at +0. 60 
by the CRT lock manager, and should be raised to 
approximately +0. 70. That way, the probability of the 
occurance of Type II errors (false 
RECOGNITIONS/VERIFICATIONS) would be greatly decreased; 4) 
Retinal scanners are generally, very reliable. 
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I. INTRODUCTION 



The control of access to computer systems and other 
vital equipment is becoming increasingly important as they 
are entrusted with more sensitive applications and more 
valuable information. Much emphasis has been placed in 
increasing the accessibility of this equipment in order to 
accommodate the user and to enhance his ability to interact 
with it. This has posed new threats to system security and 
has emphasized the need for more adequate safeguards against 
unauthorized access (FIPS Pub 48, 1977, p. 7). Aboard 
present Naval and Coast Guard vessels , passwords, cipher 
combinations, armed Marine guards for access to surface Navy 
nuclear propulsion spaces, I.D. cards etc. are the 
safeguards utilized to protect this equipment and space. 
Should there be more of the same or should government direct 
future planning towards replacing some of these basic 
methods with newer technology. 

There are three methods by which a person's identity may 
be established: 1. something a person KNOWS like a password 
2. something that he POSSESSES like an identification 
photograph, I.D. card etc. and 3. something physically ABOUT 
that person such as height, weight, and fingerprints. 
Others include hand geometry, voice patterns, finger length, 
and blood vessel patterns posterior to the retina. 

Although weight can be useful in identifying someone, it 
is not as reliable as other physiological traits because the 
individual has the ability to change it through gain or 
loss. An unchanging unique identifier that no two subjects 
can identically possess, is most reliable when it comes to 
'ABSOLUTE identification'. This compared to VERIFICATION of 
non-physiological items like passwords that are SUPPLIED by 
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the subject attempting to gain access. Because of the 
vulnerability that the first two methods of identification 
have to threats such as theft and duplication, much emphasis 
is presently being focused on the technology of personal 
identification through physiological and morphological 
attributes( Rennick , 1975). Morphology is the study of the 
form and structure of an organism or any of its parts. 
Method three utilizes this technology. 

The scope of this thesis was to determine if the 
installation of retinal biometric devices to assist in 
protecting vital areas is feasible in a shipboard 
environment. Two models of the Eye Dentify 7. 5 retinal 
scanner by Eye Dentify Inc. Beaverton, Oregon were utilized 
during experimentation. See Figure 1. 1 to view the DAISY 
7. 5 retinal scanner. Figures 2. 2 and 2. 3 display the newer 
version DOT 7. 5 that has recessed eyeports. A transverse 
motion simulator with variable speeds and angle of roll up 
to fourteen degrees was used to simulate vessel motion. 




Figure 1. 1 Eye Dentify Inc. DAISY 7. 5 Scanner 
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II. THE EXPERIMENT 



A. EQUIPMENT 

The Eye-dentify machine is based on the concept of 
biometrics, the application of mathematical-statistical 
theory to biology. The 7. 5 scanner utilizes the retinal 
patterns of humans as the unique identifier. This identifier 
is needed to disseminate between subjects trying to gain 
access to a security area via the 7. 5. A study by Dr. 
Carleton SIMON and Dr. Isadora GOLDSTEIN concluded that, 

the spatial patterns exhibited by the internal blood 
vessels of the human eye are a highly stable , highly 
deterministic source of biometric information. 
(Goldstein, Simon, 1935) 

Through the efforts of Dr. Paul Tower(1955), these prior 
findings were enhanced by his study that showed that the 
greatest dissimilarities between monozygotic( identical ) 
twins, was in the retinal blood vessel patterns. 

The hardware components for the two 7.5's include a 
binocular eyepiece for the DAISY and a recessed 
monocular( right eye) eyeport for the DOT. This difference 
is the only one between these scanners. Other components are 
LED display, cast aluminum housing, 12 digit keypad(0-9, # 
*), SCAN button, internal 68000 microcomputer chip and 
electronic camera. The weight of a 7.5 is approximately 26 
pounds. External to the scanner is a system compatible 
terminal for I/O interface. A printer option was available 
through an auxiliary port. A 640K( RAM) microcomputer was 
used to 'download' data to floppy disk as a 'backup' or 
'upload' to the 7.5. 

The Eye-dentify 7. 5 has internal software that controls 
the system's operation, and operation of external devices 
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and IBANK storage for the signature templates corresponding 
to those human eye patterns that have been enrolled. 

1. I CAM Camera 

The ICAM( camera) scans/illuminates a fovea centered 
circle, on the inside posterior section of the eye which 
includes the retina and choroid. The retina, continuous with 
the optic nerve, is that part of the eye that receives the 
image produced by the crystalline lens. The optic nerve 
conducts impulses from the retina to the brain. The choroid 
is a delicate, highly vascular layer that is continuous with 
the iris( color surrounding the pupil) and lies between the 
sclera(part of the dense external covering of the eyeball) 
and the retina( Webster ' s Die, 1984). The scanned circle has 
a 0. 8 degree radius and its size, expressed as an external 
field half angle, is ten degrees. Infrared light is the 
medium used in illumination. The amount emitted is 
equivalent to the portion of infrared contained in the 
natural light shining from the bulb in a refrigerator. This 
same infrared is also found in home smoke alarms and VCR 
remote controls. 

The light that is reflected off the blood vessels, 
retina and choroid, is passed through a photo sensor. It is 
then scattered and 320 12-bit measurements are captured 
along a 450 degree, (450/360= 1.25 rotation), camera lens 
scan. An analog waveform is developed and then digitized via 
an A/D( analog-digital ) converter. The digital signal is then 
sent to the microcomputer chip for processing and then 
stored in IBANK memory as a 320 bit eye signature in PIN 
verification mode. See Figure 2. 1 for an illustration of 
the system flow diagram. 
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SYSTEM FLOW DIAGRAM 




CAMERA 
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A/D CONVERTER 



ICAM (eye camera ) 



320 element live scon. 

WAVEFORM PROC 

256 element live 10 signal 

MODE SWITCH 



/ 
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VERIFY->.or 




Recognised 
REC0GNI2E-> WHO or 

Not Recognized 



Dedicated 68000 hiicrocomputer 



EEPROM or bubble memory 



EYE SIGNATURE - composite of live ID signals acquired during 
enrollment process. Each eye (left and right) is packed into 
40 bytes (320 bits) for storage in the Ibank 

ICAM “ acquires and digitizes the identification pattern from 
the subject's eye 

IBANK - Storage of all Eye Signatures (reference templates) 

PIN - Personal Identification Number. Used in Verify mode to 
select specific Eye Signature for match 

MODE SWITCH - Selects the mode of the 7.5. Enroll mode allows 
a new individual to be added to the Ibank. Verify compares 
a live eye with the Eye Signature designated by the PIN 
entry. Recognition automatically selects best Eye Signature 
from the Ibank 

Figure 2.1 System Flow Diagram, Extrac. ( Eye-Dentify 7.5,1984) 
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In verification mode with 1200 eye patterns on file, 
verification would take about 1.5(15/10) seconds. Of this 
time, six tenths(6/10) of a second is for rotational delay 
as the ICAM spins the 450 degrees( 1. 25 rotations) required 
in the scanning process. The remaining nine tenths (9/10) of 
a second is for processing bits in the microprocessor that 
are associated with the specific eye signature that is being 
compared to the 'live eye' just scanned. With recognition 
mode, the time required for individual processing depends on 
the number of templates in memory. With fifty templates, 
response time is approximately two seconds. 

2. Recognition Eye Signature Data Structure 

The eye signature data structure for recognition 
mode is 72 bytes (576 bits). Forty(40) bytes are used for 
verification purposes, thirty two(32) for recognition. The 
reason for this diversification is SPEED OF RESPONSE. 
Whenever scanning in recognition mode, whether there are 
fifty or twelve hundred templates in bubble memory, the five 
closest templates to the 'live eye' scanned are chosen for 
further comparisons. An algorithm based on fourier cross 
correlation is used on the (32 byte) recognize templates. 
This allows for the fastest possible selection of the five 
most similar templates. The corresponding time is actually 
less than 50 milliseconds for a sample of 100 subjects in 
bubble memory. (Eye Dent letter, Jan 86) Next, verification 
mode procedures are implemented on the chosen five to select 
the best template match for the live eye. The first 
verification that exceeds the threshold requirements is the 
eye that is considered recognized. The match is then 
displayed in the LED window and on a printer if connected. 
This explains why it takes longer to get a response when 
scanning in the recognition mode. Time for the fast fourier 
analysis plus the time for 5 verifications. If this method 
was not available, EACH template in bubble memory would have 
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to be compared via verification methodology against the 
'live' eye pattern. This would take an impractical amount of 
time. For example, with 200 subjects in memory and no 
fourier analysis, it would take ((9/10 sec/template )*( 200 
templates)= 3 minutes, and this would only be processing 
time. 



B. THE MOVING PLATFORM 

A moving platform was constructed to test how both the 
DOT and DAISY Eye-Dentify 7.5 would perform in a seaway. 
Transverse roll would be measured with the use of a 
protractor mounted horizontally and a plumb line hanging 
vertically. The platform was designed to roll only in one 
dimension due to money, time and material constraints. 
Therefore, this would eliminate the other sensations of 
motion that any individual riding aboard a vessel at sea 
would encounter. These would be YAW, angular motion about 
the vertical axis, and PITCH, fore and aft rotation about 
the Center of Floatation lateral axis. The testing would be 
done at rolls of seven degrees and fourteen degrees. These 
were chosen as being representative of common sea states. 
The mechanical constructs of the platform, and the output 
power of the electrical motor used to generate motion, 
hampered testing at angles greater than this. 

The time(sec) from port to starboard to port was also 
varied on the moving platform. This to model the periodicity 
of waves as they pass under the hull of a ship and the 
resultant cycle times ,also known as Period of Roll that 
occur. (Naval Ships Technical Manual 079 VOL. 1 -Stability and 
Buoyancy, 1983) The height of a wave at sea, and also its 
length in feet from crest to crest will have an effect on a 
ship's "ride". To capture this phenomenon, a permanently 
lubricated ZERO-MAX variable drive attached to a three 
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quarter horsepower, sixty hertz, 1725 rpm electric motor was 
used. This variable drive was rated to deliver a maximum of 
100 inch-pounds of torque to its output shaft. A 10: 1 
reduction gear was connected to this output shaft to create 
the desired shaft rotation needed to rotate the 10. 25 inch 
diameter drive wheel that the 19. 5 inch drive arm was 
attached to. This drive arm, that was connected to the 
platform, required lubrication with graphite bearing grease. 
Although this was the case, there were two instances where 
bolts used to connect the drive rod to the drive wheel did 
fail under load. 

To insure that all measurements which dealt with cycle 
time were noted under a constant regimen, a benchmark scale 
located atop the ZERO-MAX was utilized. This scale had 
values ranging from zero to six. With the use of a hand 
wheel that adjusted the ZERO-MAX, a setting within this 
range could be established. Simply, a direct relationship 
between the benchmark setting and the cycle time(sec) 
occured. The higher the setting, the faster the cycle time. 
If set at a value of 6, the cycle time in seconds was very 
small meaning the moving platform would "snap" back and 
forth from port to starboard. For experimentation purposes, 
Eye-Dentify 7. 5 scans using both DOT and DAISY machines were 
taken at benchmark values of 1. 0 and 1. 5. These settings 
gave respective cycle times of approximately 10 seconds and 
20 seconds. The first value representative of a turbulent 
sea state with rough seas, the second a more moderate , 
gentle sea state. 

The platform was mounted inside a rectangular base used 
for structural strength. Two plywood mounting braces were 
installed on either side of the moving platform. One was 
used as a safety step for students to mount and dismount the 
platform, the other as a mount for the motor, variable drive 
and reduction gear. The platform was hex bolt pinned forward 
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and aft, to the rectangular base. It was about these points, 
that the platform would rotate transversely. Subjects were 
allowed to mount and dismount only from the right side. This 
way they would have no interaction with any of the 
mechanical devices. A chair was mounted centrally on the 
plywood platform base. Initially, the subjects were to be 
tested in the standing position, but this proved to be 
unrealistic. At faster cycle times, they were unable to 
safely maintain their balance. Also, in the standing 
position, their weight would be distributed at a higher 
center of gravity thereby putting undue loads on the slip 
belt of the variable drive, which inevitably might have lead 
to a mechanical failure. See Figure 2. 2 below and 2. 3 on 
the following page for visual description of the platform 
and the DOT 7. 5 scanner. 




Figure 2. 2 The Transverse Motion Simulator-Side 
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Figure 2.3 The Transverse Motion Simulator-Rear 



A seatbelt was required at all times when data 
collection was undertaken for safety considerations. The 7. 5 
was mounted at a height of 40. 5 inches above the platform in 
compliance with prior guidelines determined at the Sandia 
National Laboratories, Albuquerque, New Mexico, in June 1985 
( Maxwell, undated ) . This height allowed the least amount of 
stooping when eye scanning in the sitting position. The 
system operator controlled the electric motor via a remote 
switch, and would instruct each person in the operation of 
both the DAISY and DOT 7. 5 prior to starting the motor. 
Because each subject had been through an earlier explanation 
during initial template enrollment , this second explanation 
only had to be done once, saving much time. 

Connected to the auxiliary port of the Eye-Dentify was 
an Okidata u93 serial printer. Output displayed on the 
printer was subject's PIN( personal identification 
number ), identification code, which can be any letter or 
number , whether the person (was/was not) 
VERIFIED/RECOGNIZED, correlation score and the date. The LED 
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display of either machine will show up to eight of these 
characters. 



C. THE OBJECTIVE 

The objective of this experiment was to compute Type I 
and Type II error rates when subjects were tested under 
dynamic conditions created when the transverse motion 
simulator was used. The recognition and verification 
thresholds would be held constant at +0. 60. Results from an 
earlier test that used the Range Test on Means method 
(Helle,1985) indicated, little difference in findings 
between the lowest possible setting of +0. 60 and the 
midpoint setting of +0. 72. Therefore, +0. 60 was chosen to 
ascertain how each retinal biometric scanner would perform 
under the least stringent threshold setting. 

This would be the first occurance of a dynamic test on 
any Eye-Dentify 7. 5. All earlier tests were static. As 
experimentation proceeded, results showed an unusually large 
occurance of Type II errors with the DOT 7.5, especially in 
VERIFICATION mode to specific individuals. Therefore, an 
additional objective was included, to determine if the 
accuracy of this biometric scanner was worse than 
advertised. 

The research dealt with the possible use of these 
scanners aboard Coast Guard and Naval vessels in a variety 
of applications, such as radio and crypto spaces. Other 
significant potential uses at sea are access to computers 
and their systems, the CMS( communication security material 
system) vault, supply office cash vault, the entrance to 
nuclear engineering spaces, and activation of a weapon 
launch. Also possible is communication equipment control and 
security, including authentication and recognition. 
Additional military applications might include strategic and 
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tactical command control, security for, or part of the 
nuclear missile launch sequence at our silos. 

An added plus, was the availability of the newer version 
DOT 7. 5 scanner to the system operator. Not only could the 
question of how motion affects the system be investigated, 
but an additional objective of comparing ease of use, 
accuracy, and the number of Type I and Type II errors that 
occur between the DOT and DAISY be scrutinized. These 
objectives were made as specific as possible to create an 
atmosphere of simplicity, thoroughness and accuracy. 

D. EXPERIMENTAL PROCEDURE 

Sixteen subjects were chosen at random from a total of 
approximately sixty students that were enrolled in the same 
MAN-MACHINE INTERACTION course at the Naval Postgraduate 
School. Taking this specific course did not unfairly 
prepare any of these students for the extensive 
experimentation that was to follow. Three females and 
thirteen males( 14 military, 2 civilian) were chosen with the 
use of a random number generator. Their ages ranged from a 
high of 51 to a low of 27. Those that wore contacts were 
allowed to wear them during the analysis, while glasses were 
not. They hampered some subjects during scanning. None of 
the sixteen stated that they were totally or partially color 
blind. During the initial enrollment process, all sixty 
OS3404 class members, became the template database. There 
were instances where students not involved with the motion 
testing exhibited either slight color blindness or chronic 
stigmatism, which caused trouble when trying to enroll them 
into the DAISY 7. 5. This was not the case with the DOT 7. 5. 
None of the sixty had ever used either 7. 5 system before. 
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1 . 



The Enrollment Process 



To implement the enrollment process, a system 
compatible CRT (Cathode Ray Tube) was required to be 
connected via ribbon cable to the terminal port of the 7. 5. 
Assuming power has been secured to the system, the operator 
had to first gain access to the software main menu. This was 
done by scanning his own eye. This allows access because the 
system operator was listed under CRT lock management, 
another name for database management. After this step, 
enrollment may be initiated by typing E with a carriage 
return. When enrolling a person, they must be directed to 
concentrate because very low correlation scores will occur 
if instructions are not followed. Below are the guidelines 
to follow when enrolling ONLY on the DAISY wheel scanner: 



1. Square the head up to the binocular eye ports. 



2. Look into the eye ports and concentrate only on the 
center of the daisy design to the upper left. Ignore 
the second one you see to the lower right. The left 
eye port is blanked off and it slides left and right 
to provide a comfortable fit. Keep both eyes open. 



3. Move your head about, until all red is removed from 
view with only the greenish- white daisy design 
remaining. This is where the majority of problems 
occured with subjects who were slightly color blind to 
greens or reds. 



4. Press the SCAN button on the front of the machine very 
gently. Erroneous data can occur by moving the machine 
when pressing too hard if it is not permanently 
mounted. 



The following are guidelines implemented when enrolling ONLY 
on the DOT scanner: 



1. Square the head up to the machine and place forehead 
on headrest. Notice there are no binocular eye ports, 
only one recessed eye port for the right eye. The 
white line adjacent to this eye port is to be used 
optionally to align the center of the right pupil to 
the center of the eye port. 



2. Once on the headrest, do not move the head up or down, 
only to the left or right when you have the beam of 
light in view. You will perceive depth that you did 
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not sense when using the DAISY. Place the 3 dots of 
light that appear atop one another in a vertical line. 
One dot will now appear. Place it in the center of the 
outer semi-circular ring. For some, the dot will look 
as if it is the apex of a three dimensional cone. The 
act of fixating on this dot or the center of the daisy 
pattern in the older version 7. 5 centers the scan 
circle on the fovea. This is the part of the retina 
that corresponds to the center of vision. 



3. Press the SCAN button gently, as with the DAISY. It is 
also located in the same position mentioned earlier. 



When the SCAN button is depressed, the I CAM camera 
is activated and a template is created and stored in memory. 
After the first scan, a message will display on the CRT. At 
this point the system operator has three choices: 



1. Finish enrollment and identify PIN (personal 
identification number) with a code. 



2. Restart the Enrollment Process - 

retaining only the previous retinal scan as the 
beginning of a new reference template. All 
previous eye signatures accumulated during the 
enrollment session are erased. This function is 
useful when previous correlation scores have been 
low and the enroller wishes to restart the 
enrollment process. ( Eye-Dentif ication Inc., 1985) 



3. Cancel the current session altogether. 



To acquire OPTIMUM memory templates, user manual 
procedure required the enroller to take at least 5 eye scans 
where the average correlation score of the entire five was 
+0. 90. These correlation scores appear automatically on the 
CRT display terminal and they can be ignored or averaged 
with the person's template stored in memory. All sixteen 
subjects associated with the moving experiment not only met 
this requirement but were able to be enrolled with accepted 
correlation scores never below +0.90, so any average of the 
five scans taken would be well above +0. 90. A correlation 
score is the mathematical representation computed by the 
68000 microprocessor that defines how similar that live eye 
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scan just processed is to the person's most recent template 
in Ibank memory. 

2. Factors Tested 

When testing began using the transverse motion 
simulator, the sixteen subjects were told to report during 
announced times. They would have to report eight separate 
times with at least a one hour delay between tests, for 
learning curve purposes. The commencement date was 08 
November 1985 with completion of all phases of the 
experiment occuring on 27 November 1985. Both the drive arm 
linkage, DAISY and DOT machines had to be changed and 
adjusted manually for the duration of the experiment, which 
is one reason for such an expanded time frame. The drive arm 
procedure in particular, was considerably time consuming. 
On the drive wheel, were drilled 7/16 inch threaded holes 
outward from its center in the form of an arc, through which 
the connecting 7/16 inch bolt would pass through. Here, the 
drive wheel and drive arm were attached. The bolt would have 
to be moved to a new hole along the arc, whenever a change 
in angle of roll was required in the analysis. Criteria for 
experimentation required the machines to be scrutinized 
under the same conditions, chosen on a random basis. These 
FACTORS are listed below: 

1. DAISY Scanner 

2. DOT Scanner 

3. Angle of roll 7 degrees 

4. Angle of roll 14 degrees 

5. Cycle time of 10 seconds corresponding to a setting of 
1. 5 on ZERO-MAX scale. 

6. Cycle time of 20 seconds corresponding to a setting of 
1.0 on ZERO-MAX scale 

A successful recognize was represented by a Y(YES) 
in the system operator's log sheet. For this to happen, a 
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subject would have to receive a correlation score equal to 
+0. 60 or higher with their personal identification number 
(PIN) and identification code correctly identified. If the 
statement NOT RECOGNIZED were to appear, it would mean their 
correlation score was lower than +0. 60. In this instance, no 
PIN or identification code is printed, only the correlation 
score and date appear. As noted earlier, if this were to 
successively happen three times, the warning SEE SECURITY 
SEE SECURITY SEE SECURITY would flash in red letters on 
the digital display on the face of either 7. 5 machine. 
Inclusive with this is an audible alarm that would sound for 
a pre-programmed duration. This sound and L. E.D warning 
announced the occurance of a TYPE I ERROR, as the individual 
was attempting to be RECOGNIZED/VERIFIED. 

3. Hypothesis Type I. Errors 

Formally, the HYPOTHESIS for this Type I error 
analysis is: the subject attempting entry IS located within 
IBANK memory. This hypothesis is true, but if the hypothesis 
is true and it is REJECTED, an error has been committed 
known as Type I error ( Freund | Williams, 1982, p. 316). The 
system would NOT allow the individual to gain access, when 
it SHOULD have. When a Type I error did occur, a notation 
was made in the log sheet using the symbol N for NO. 

At each session, all sixteen subjects were required 
to complete six trials. One trial is defined as receiving 
either a Y or N. Two sessions of six trials would have to be 
finished before the subject was considered done in reference 
to testing under a specific FACTOR. It was the system 
operator's responsibility to randomly assign cycle per 
minute settings of either 6. 0 cpm or 3.0 cpm as the subject 
was being tested in the motion simulator. An example to 
provide clarity follows. 
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On day one, subject 0037 reports at 1100am to be 
tested using the DAISY scanner at a roll of 14 degrees. 
Before energizing the electric motor, the system operator 
sets the handwheel atop the variable drive to correspond to 
a cycle time of 10 seconds. Six trials are to be taken, so 
the first three trials are noted with the cycles per 
minute( cpm) at 6. 0( ( 60sec/min) *( lcycle/10 sec)). The second 
three trials are taken with a 3.0 cpm. The system operator 
was able to vary CPM settings as the platform rotated. This 
way the student would not be distracted and physically 
jolted by a constant starting and stopping of the motor. 

Initially, many students were inquisitive concerning 
when they should depress the SCAN button when testing on the 
transverse motion simulator. Common sense would tell them to 
do this at either a roll of zero degrees or at the extreme 
port or starboard angle of roll. It was at these positions, 
that upright attitude for the former and relative motion for 
the latter , create the most comfortable atmosphere. All 
sixteen who participated, were instructed to depress the 
SCAN button whenever they felt at ease in doing so, ensuring 
that data would be collected in a RANDOM manner. From the 
onset, there was never a problem with retaining totally 
random roll positions that 7. 5 scans were taken at. As time 
progressed, their apprehension was alleviated, because with 
repetition, they saw how easy it was to scan at any angle. 

The format of the four log sheets maintained by the 
system operator consisted of two columns used to annotate a 
Y or N score. The left column for data entries corresponding 
to a shipboard period of roll of TEN seconds and the right a 
period of roll of TWENTY seconds. The six separate testing 
FACTORS (DOT, DAISY, roll=7, roll=14, cycle time 10 sec, 
cycle time 20 sec) made up the log sheets and are noted in 
the following list. 
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1. 


Log sheet 


1: 


Using 


the 


DAISY 


I CAM at 


seven degree roll 


2. 


Log sheet 
roll 


2: 


Using 


the 


DAISY 


I CAM at 


a fourteen degree 


3. 


Log sheet 


3: 


Using 


the 


DOT I CAM at a 


seven degree roll 


4. 


Log sheet 
roil 


4: 


Using 


the 


DOT 


ICAM at a 


fourteen degree 



As mentioned previously, all scans were taken in the 
RECOGNITION mode, where that scan would have to be matched 
against all 576 bit( 72 byte templates): 

either stored in the EEPROM (electrically eraseable 
programmable read only memory chip) for twenty or less 
enrollees, or BUBBLE MEMORY with a capacity of up to 
twelve hundred enrollees. (Eye-dent, 1985) 

While the VERIFICATION mode provides greater security than 

the RECOGNITION mode because both an eye scan and a PIN must 

be correctly accepted by the machine, it was not included. 

VERIFICATION requires personnel to MEMORIZE and physically 

KEY- IN their personal identification number(PIN) to the 

twelve digit keypad on the face of 7.5. This defeated the 

purpose of investigating a system that does not require the 

use of a memory code or password. One of the directions that 

this thesis was determined to take was analyzing this very 

principle. ONLY THROUGH THE RECOGNIZE MODE COULD THIS BE 

ACCOMPLISHED . 

E. THE RESULTS 

NOT RECOGNIZED percentages were computed by counting all 
scans taken by either the DOT or DAISY scanner at the 
appropriate angle of roll. This number was then divided into 
the number of correlation scores that were +0. 59 and lower. 
These percentages are listed in Table 1 . The newly 

introduced DOT 7. 5 clearly shows in its data that when used, 
queue time drops significantly when compared to the DAISY. 
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For example, at fourteen degrees inclination, only 13 out of 
202 DOT scans( 6. 44%)were logged as NOT RECOGNIZED (which 
means that scan was unacceptable), while 66 out of 251 
scans( 26. 29%) was the corresponding percentage for the 
DAISY. Additionally, for BOTH machines, as the angle of 
roll increased, the higher the ratio of NOT RECOGNIZED to 
TOTAL scans . This implies increased queue time, the greater 
the sea state. Figure 2. 4 is a column chart, with NOT 
RECOGNIZED percentages for the DAISY 7. 5 and the DOT 7. 5 on 
the y axis versus angle of roll in degrees on the x axis. 




Figure 2. 4 Not Recognized Percentages 

AVERAGE CORRELATION SCORES for RECOGNIZED PIN's were 
computed by summing correlation scores( +0. 60 and higher), 
from the appropriate serial printer log sheet and dividing 
by the number of successful recognized scans. This for a 
particular Eye-Dentify and its requisite testing criteria. 
This data is noted in Table 2 -v. DOT 7. 5 scores for seven 
and fourteen degrees of roll were above the +0. 90 
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TABLE 



1 



NOT RECOGNIZED PERCENTAGES 



DAISY 7 DEGREES: 58 NOT RECOGNIZED OUT OF TOTAL 

OF 251 SCANS 58/251= .2310 = 23.10% 



DAISY 14 DEGREES: 66 NOT RECOGNIZED OUT OF 

TOTAL OF 251 SCANS 66/251= .2629 = 26.29% 



DOT 7 DEGREES: 9 NOT RECOGNIZED OUT OF TOTAL 

OF 208 SCANS 9/208= . 04326 = 4. 326% 



DOT 14 DEGREES: 13 NOT RECOGNIZED OUT OF TOTAL 

OF 202 SCANS. 13/202= . 06435 = 6. 435% 



DAISY OVERALL: 124 NOT RECOGNIZED OUT OF TOTAL 

OF 502 SCANS 124/502=. 2470 = 24. 70% 



DOT OVERALL: 22 NOT RECOGNIZED OUT OF TOTAL 
OF 410 SCANS 22/410=. 0536 = 5.36% 
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plateau, (+0.912, +0.906 respectively) easily surpassing the 
maximum allowable RECOGNITION threshold setting of +0. 85. 
The system operator might want to implement this 
setting( +0. 85 ) for maximum security requirements. The DAISY 
7.5 was in the low "eighties", ( +0. 823 , +0. 802 ) respectively 
and would not have met this limit. It is noteworthy to 
realize that these are only AVERAGES, nonetheless this 
comparison between the two machines does imply a definite 
trend that they have differing performance characteristics. 

Both DOT and DAISY machines had AVERAGE correlation 
scores for NOT RECOGNIZED scans in the same range of (+0.41 

+0.44). Figure 2.5 is a column chart of average 
CORRELATION scores for the DAISY 7.5 and DOT 7.5 on the y 
axis versus angle of roll in degrees on the x axis. 
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Figure 2. 5 Ave Correlation Scores 
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TABLE 2 

AVERAGE CORRELATION SCORES 



DAISY 7 DEGREES: AVE CORRELATION SCORE FOR 
RECOGNIZED WAS 159.21/193= +.8249 

AVE CORRELATION SCORE FOR NOT RECOGNIZED WAS 
25. 68/58=. 4427 

DAISY 14 DEGREES: AVE CORRELATION SCORE FOR 
RECOGNIZED WAS 148.37/185= +.8020 

AVE CORRELATION SCORE FOR NOT RECOGNIZED WAS 
29. 51/66=. 4471 

DOT 7 DEGREES: AVE CORRELATION SCORE FOR 
RECOGNIZED WAS 181.51/199= +.91211 

AVE CORRELATION SCORE FOR NOT RECOGNIZED WAS 
3. 73/9 =. 4144 

DOT 14 DEGREES: AVE CORRELATION SCORE FOR 
RECOGNIZED WAS 171.37/189= +.90671 

AVE CORRELATION SCORE FOR NOT RECOGNIZED WAS 
5. 75/13=. 4423 

AVE CORRELATION SCORE FOR 7 DEGREES WAS 
340. 72/392= +0. 8692 

AVE CORRELATION SCORE FOR 14 DEGREES WAS 
319. 74/374= +0. 8549 

AVE CORRELATION SCORE FOR CPM OF 3.0= +0.8508 
AVE CORRELATION SCORE FOR CPM OF 6. 0= +0. 8377 
DAISY OVERALL AVE CORR. SCORE 307.58/378= +0.8137 
DOT OVERALL AVE CORR. SCORE 352. 88/388= +0. 9095 
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As stated earlier, a trial was complete when either a 
Y(yes) for a RECOGNIZED eye scan was logged or a N(no) which 
represented a TYPE I error( three successive NOT RECOGNIZED 
eye scans) was noted. A binomial distribution was expected 
concerning the data dealing with these trials, where the 
number of trials was fixed, the probability of a success was 
the same for each trial, and that the trials were all 
independent ( Freund | Williams, 1982). The trial results 
collected on each subject were logged in groupings of six, 
and each had a particular cycle per minute speed setting, 
angle of roll and 7. 5 machine associated with it. Data 
points could then be found by solving for the ratio of 
Y(yes) trials in the numerator divided by 6 total trials in 
that grouping. Three proportions were noted. They were 
(6/6)= 1.00, (5/6)= 0.833 and (4/6)= 0.666. There were a 
total of 128=( 768 trials/6) separate data points. The 
mathematical transformation formula y= 2arcsine( sgrt( x) ) was 
used to stabilize the variance in the data (Winer, 1971). To 
utilize this equation, the values 0. 666, 0. 833 and 1. 00 had 
to be converted to radians. These radian values were 
3.1416(pi), 2.3006 and 1.9106 respectively, and were entered 
as (x) in the transformation formula. A level of 
significance of 0. 05 was selected when using F tables. 

A four way analysis of variance( AOV) done by a computer 
AOV 'package' was implemented on the data. The results are 
listed in Table 3 . 

The analysis showed that the effect of both A( angle of 
roll) ( F= 5.7870, DF= 1,15) and Su x Sp x A ( F= 2.8070, DF= 
15,15) were the most significant relationships measured. 
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TABLE 3 

ANALYSIS OF VARI ANCE/EYE-DENTIFY 7.5 RECOGNITION RATE 



SOURCE 


DF 


SS 


MS= 

SS/DF 


F= 

SS/MS 1 err 


F ratio 
from tables 


Su( Subjects) 


15 


1. 1877 


0. 0792 


1. 9850 


2. 40 


Sp( Speed) cpm 


1 


0. 0012 


0. 0012 


0. 0301 


4. 54 


A( Angle ) 


1 


0. 2309 


0. 2309 


5. 7870 


4. 54 *sig* 


M( Machine ) 


1 


0. 1101 


0. 1101 


2. 7594 


4. 54 


Su X Sp 


15 


1. 3376 


0. 0892 


2. 2356 


2. 40 


Su X A 


15 


0. 7543 


0. 0503 


1. 2607 


2. 40 


Su X M 


15 


0. 8750 


0. 0583 


1. 4612 


2. 40 


Sp X A 


1 


0. 0130 


0. 0130 


0. 3258 


4. 54 


Sp X M 


1 


0. 0012 


0. 0012 


0. 0301 


4. 54 


A X M 


1 


0. 0335 


0. 0335 


0. 8396 


4. 54 


Su X Sp X A 


15 


1. 6793 


0. 1120 


2. 8070 


2. 40 *sig* 


Su X Sp X M 


15 


0. 9839 


0. 0656 


1. 6441 


2. 40 


Sp X A X M 


1 


0. 0336 


0. 0336 


0. 8421 


4. 54 


Su X A X M 


15 


0. 5979 


0. 0399 


1. 0000 


2. 40 


ERROR 


15 


0. 5979 


0. 0399 






TOTAL 


127 


8. 4371 








Level of significance = 0 


. 05 
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III. 



DISCUSSIONS 



A. ERRORS 

1. Type 1 Errors 

The listing shown in Table 4 and Table 5 gives the 
breakdown of Type I errors that occured, given a particular 
Eye-Dentify machine, cycle per minute rate( represented by 
ZERO-MAX settings of either 1. 0 or 1.5) and angle of roll. 
The numerator of the fraction, contains the number of false 
rejections( three NOT RECOGNIZED scans sequentially by the 
same person) and the denominator, the total scans attempted 
by the individual under these criteria. 

The four column charts that follow Table 4 and Table 
5, display Type I error results. Figure 3. 1 charts the 
NUMBER of Type I errors on the y axis versus DOT and DAISY 
scanners on the x axis. Figure 3.2 charts the NUMBER of Type 
I errors on the y axis versus the period of roll in cycles 
per minute on the x axis. Figure 3. 3 charts the NUMBER of 
Type I errors on the y axis versus the angle of roll in 
degrees on the x axis. Figure 3.4 charts the Type I error 
PERCENTAGE for this experiment only, on the y axis versus 
the corresponding DOT and DAISY scanner on the x axis. 

The overall Type I error rate was thirteen errors 
out of a total of 768 trials or 1. 69%. Brochures from the 
Eye-Dentify company( 1985 ) state that, "the chance of a false 
re j ection( Type I error) is AS LOW AS 0.1% dependent on the 
system threshold setting and proper use." (Eye-Dentify 
Inc., 1985) No formal experiment was published which 
indicates that this probability was tested (Helle, 1985). A 
company spokesman did elaborate though, that this value 
could be achieved under ideal conditions , consisting of 
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TABLE 4 

TYPE I ERROR RATES 



14 DEGREE ROLL 
DOT SCANNER 



Cycle/Min rate --3. 0 6. 0 

TY. I ERROR/TRIALS 

2/96= 2.08% 1/96= 1.04% 

14 DEGREE ROLL 
DAISY SCANNER 

3.0 6.0 

3/96= 3.13% 4/96= 4.17% 



7 DEGREE ROLL 
DOT SCANNER 

3.0 6.0 

0/96= 0. 00% 1/96= 1. 04% 

7 DEGREE ROLL 
DAISY SCANNER 

3.0 6.0 

1/96= 1.04% 1/96= 1.04% 
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TABLE 5 

BREAKDOWN OF TYPE I ERRORS 



**TOTAL NUMBER OF TYPE I ERRORS (N)= 13** 
DAISY TYPE I error = 9 out of 13 

DOT TYPE I error = 4 out of 13 

14 DEG ROLL TYPE I = 10 out of 13 
7 DEG ROLL TYPE I = 3 out of 13 
CYCLE TIME 10 sec = 7 out of 13 

CYCLE TIME 20 sec = 6 out of 13 

768(96*8) TRIALS LOGGED DURING TESTING 
OVERALL TYPE I FAILURE =13/768=. 0169=1. 69% 
OVERALL SUCCESS =1-. 0169=. 9830= 98.30% 
DAISY TYPE I ERR% = 9/(768/2)= 2.34% 

DOT TYPE I ERROR % = 4/(768/2)= 1.04% 
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OF 

Type One Errors 




Figure 3. 1 Dot/Daisy Type I Errors 
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Type One Errors 




Period of Roll (CPM) 



Figure 3.2 Cycle Rate(cpm) Type 



I Errors 
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Figure 3.3 Angle of Roil( degrees) Type I Errors 
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excellent enrollments and proper scanning procedures. Since 
this test measured the accuracy of both DAISY and DOT 
machines at the lowest possible RECOGNITION threshold 
setting of +0. 60, increasing the setting would increase the 
Type I error rate. Proper use of the machines and the strict 
following of user instructions is an extremly important 
aspect to consider when discussing/dissecting these results. 
The enrollment procedure and concentration by the subject 
being scanned, are just a few variables that can effect the 
outcome. 



The most substantial relationship discovered in the 
transformation variance computations was that of increasing 
the angle of roll on the transverse motion simulator. The 
computed F ( SS/MS error) was 5.7870. The value from the F 
tables( level of significance = 0.05) was 4.54. Ten of 
thirteen( 10/13 ) Type I errors occured when roll was 
increased from seven to fourteen degrees. While other 
relationships were not as significant as this, (i.e. , no 
significance surfaced when examining the variance analysis), 
certain outcomes should be noted. Fifty percent (8/16) of 
the subjects tested did not have any occurance of Type I 
errors. Of the remaining eight subjects that had Type I 
errors, 4 of the 8 had 69.2% of the errors. 

The newer version machine(DOT) had fewer Type I 
errors (4/13) than the DAISY, which might be attributed to 
the fact that fifteen out of sixteen subjects preferred 
using the DOT 7.5, feeling more confident when using it. One 
felt that with his poor eyesight, "it was difficult to 
distinguish the daisy pattern, yet could line up quite 
easily the blurry cone with the three green dots. " Those 
that are color blind to greens and reds will have problems 
with the DAISY 7.5, but they will function with the DOT 
where depth perception and not color is important. The one 
subject, PIN(0038) that preferred the DAISY, had three of 



37 



the total thirteen Type I errors(23%). Two of those three 
occured on the DOT. The remaining fifteen subjects liked the 
three dimensional cone/dot depth alignment system on the DOT 
over the two dimensional plane view of the greenish- white 
daisy wheel provided on the DAISY. 

For health reasons, it would seem wise to utilize 
the recessed eye port construction of the DOT because the 
eye does not come in contact with anything. The forehead is 
placed on the headrest. With the DAISY, the eyeball and 
possible tears have a greater chance of coming in contact 
with the rubber protection guards, promoting the possible 
spread of a virus or germs to others. Overall Non- 
Recognition percentages for DOT were (5.36%) and (24.70%) 
for DAISY. This implies, a person using the DAISY 7. 5 is 
inevitably going to have to scan many more times to gain the 
same amount of acceptances allowed through the use of a DOT 
7. 5. 



Slightly more Type I errors occured (7 out of 13), 
when the 'period of roll' was increased implying that in 
heavy seas, the machine's performance could be downgraded 
because of problems with keeping the head still. A solution 
to this might be to shape a curved recess into the forehead 
rest of the DOT 7.5, to allow one's forehead to fit within 
it for greater stability in rough seas. The DAISY does not 
allow this option, due to its outwardly radiated eyeport 
construction. One student stated however, that resting the 
sockets of the eye on the rubber guards atop these eyeports 
does help keep the head still. Installing handles close to 
both machines would aid in stabilizing oneself in a 
shipboard environment. 

In every instance but one a logical outcome appeared 
as the factors were adjusted when testing the machines 
aboard the transverse motion simulator. All results were 
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poorer as angle of roll was increased, period of roll(sec) 
was increased and when the older DAISY 7. 5 was used. An 
exaiaple of this, noted earlier( Table 2), would be the large 
difference between the machines when comparing OVERALL 
average RECOGNIZED correlation scores. DOT = +0.9095, DAISY 
= +0. 8137, the difference being +0. 0958. The one exception 
to this logic was the occurance of five (Type II) 
RECOGNITION false acceptances ONLY on the DOT 7. 5. This 
exception is discussed in the following text. 

2. Type I I Errors 

Type II errors did occur in both the RECOGNIZE and 
VERIFY modes. Formally, the HYPOTHESIS for this Type II 
analysis can be stated : the subject attempting entry IS 
located in Ibank memory and wants to be identified by 
matching his/her own personal identification number (PIN) OR 
BX MATCHING ANY OTHER AVAILABLE PIN in Ibank memory to gain 
access. This hypothesis is of course FALSE because the 
machine is designed to accept subjects only against their 
own PIN. If this FALSE hypothesis is ACCEPTED by the 
machine as TRUE, an error has occured. This is known as a 
TYPE II error ( Freund | Williams , 1982, p. 316). In 'laymens’ 
terms, someone is allowed access ( false identification and 
acceptance) by the 7.5. Although the subject was located in 
Ibank memory, he SHOULD NOT have been recognized/verified 
under ANOTHER subject's PIN. 



In strict probabilistic terms. Type II errors can 
mathematically happen, but are not expected to occur, 
because 



every person, even an identical twin , has a widely 
divergent , unalterable retinal eye pattern. The 
chance of false acceptance in the VERIFICATION mode is 
0. 0001%( one in a million), with the phase correction on 
(normal operation). The correlation coefficient being 
+0. 70. The purpose of the software implemented phase 
corrector is to compensate for eye rotation about the 
visual axis. This eye rotation is the result of tilting 
the subject s head with relation to his/her orientation 
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during the enrollment process. (Oregon Museum of Science 
and Industry, 'White Paper', 1984) 

The corresponding odds of a false acceptance( Verification 
mode) with the correlation coefficient set at the minimum 
+ 0. 60, is approximately one in sixteen- thousand five hundred 
and two( 1/16, 502 ) or +0.00606%. This minimum setting( +0. 60 ) 
was used throughout the experiment. The odds were derived 
from studies at the OREGON MUSEUM OF SCIENCE AND INDUSTRY in 
Portland, Oregon 10 October 1984. The odds represented here 
is the result of a revision to their findings by the Eye 
Dentify company. Originally their report had stated these 
odds were one in forty five thousand( 1/45 , 000 ) or 0.00222%. 

The probability of a Type II error is hard to fixate 
in the RECOGNITION mode because it depends on the population 
size in bubble memory and the correlation threshold setting 
that is assigned by the system manager. For example, the 
LOWEST security provided would occur with the correlation 
threshold set at +0. 60 in the RECOGNIZE mode and 1200( the 
maximum) individuals stored in bubble memory. As memory 
population increases from 0000 to 
1200( 0000 , 0001 , 0002 ,... 1200 ) , the greater the odds that a 
Type II error may occur because more eye patterns are 
available to be compared/matched against. This dilemma does 
not lend itself to VERIFICATION mode, because this method 
requires the entering of the personal identification number. 
A one to one eye template match is then attempted. 
Therefore, an INDIRECT relationship between this coefficient 
and the occurance of Type II error is documented. The 
smaller the identification threshold coefficient, the 
greater the probability of a false acceptance. With Type I 
errors, the reverse is true; (DIRECT relationship). The 
larger the threshold coefficient, the greater the odds that 
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false rejections will occur because the administrator is 
'tightening' security. 

In the initial motion experiment, utilizing the 
sixteen students, one male (personal identification number 
0060) was falsely recognized under another male's code; (PIN 
0025). The DOT 7.5 was used in this instance. NO false 
RECOGNITIONS were EVER noted during the motion experiment 
using the DAISY 7. 5. Neither male had difficulties during 
the enrollment process, with the exception of a machine 
"lock-up" that required the system operator to re-start the 
enrollment process with PIN 0060. A "lock-up" connotes that 
keyboard commands and 'carriage returns' are not accepted by 
the Eye-Dentify software. To alleviate the situation, power 
was secured and re-energized, and the entire process 
reinitiated. To insure that possible bad templates were not 
located in IBANK memory under PIN 0060, all IBANK records 
were listed and checked. None were found in memory for this 
particular male. No difficulties were encountered during the 
second enrollment of PIN 0060. It is extremly important to 
grasp that the ONE false RECOGNITION occuring on 8 November 
1985, was related to PIN 0060' s SECOND ENROLLMENT AND NOT 
HIS DELETED FIRST . 

The correlation score associated with this specific 
Type II error was +0.67. He was being tested with the angle 
of roll set at a maximum of fourteen degrees, and cycle per 
minute values of 3.0 and 6.0. At all sessions, as noted 
earlier, six trials were taken. He was successfully 
recognized the first three scans, FALSELY on the 
fourth( cpm=3 . 0 ) and successfully on the latter two. The 
72-byte 'recognize' signature templates of the matched 
males, were separated by a margin of (0060-0025 = 35) PIN 
positions in bubble memory. 
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On the same day, a female(0067) was falsely 
RECOGNIZED, three successive times with scores of +0.61, 
+0.60, +0.63 under the PIN of another f emale( 0063 ) . These 
were initially considered questionable because 0067 had some 
difficulties enrolling. She DID meet the requirements of the 
enrollment process stated in the user's manual. Many 
enrollment scans had to be rejected via a N0(N) response to 
the question OK TO AVERAGE? shown on the cathode ray 
terminal, because they were not at least +0.90. The system 
operator was eventually able to acquire five scans above 
+0. 90 in reasonable time. A decision to re-enroll was made 
however, to try to attain better eye templates. The former 
scans were ignored and deleted from the system operator's 
log and IBANK memory respectively when she enrolled a second 
time very easily. The log was later recalled as a record 
that the three scores were legitimate Type II errors. This 
due to additional 'VERIFICATION' false acceptances between 
PIN 0067 and 0063 in later trials, that implied a probable 
similarity between the eye patterns of these two female 
subjects. No additional false recognitions were logged with 
this particular female or any other person related to the 
transverse motion simulator test up to this point. 

A decision was made to change over to VERIFICATION 
mode on 25 NOV 1985 and test ONLY four specific individuals. 
Those two subjects ( 0060, 0067 ) that had Type II recognition 
errors occur in the motion test, along with the two other 
sub jects( 0025, 0063 ) that they had been matched up against by 
the DOT 7. 5. This strategy included a second enrollment of 
all four individuals. This time existing templates would NOT 
be erased. Now all four would have two separate templates 
in bubble memory. Of these four, only one (0060) had both a 
Type I error and a false REC0GNITI0N( Type II) occur during 
testing. 
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The system operator programmed the DOT 7. 5 for 
verification parameters and then tested whether a false 
match might be achieved by scanning the eyes of one person 
against the two eye patterns of their match stored in IBANK 
memory. To do this, the four digit PIN of the person trying 
to be matched was entered in the numeric keypad of the Eye- 
dentify machine. The purpose of re-enrolling, was to double 
the chances of noting false verifications and to 
ELIMINATE/REDUCE the probability that system operator error 
was responsible for the THREE false RECOGNITIONS between 
PIN(0067) and PIN(0063) and the ONE false RECOGNITION 
between PIN 0060 and PIN 0025 reported earlier. This, in 
addition to the coincidence that the only occuring 
software/hardware "keyboard lock-up" on 8 November 1985 
happened to that same individual, namely 0060. Males only 
tested against males, females only tested against females. 
Testing under these circumstances, provided the results 
noted in Table 6 . 

For Table 6, MALE 1(0060) is represented by 
PIN' s( 0060 , 0069 ) . MALE 2(0025) is represented by 
PIN' s( 0025,0071). FEMALE 1(0063) is represented by 
PIN' s( 0063,0070). FEMALE 2(0067) is represented by PIN's 
(0067,0072). The first PIN (O, ) is the older enrollment, 
and the second PIN ( ,N)the newer. 

On 25 NOV 1985, a false VERIFICATION was recorded 
with a correlation score of +0. 64. The significance of this 
particular scan, was that it was the first time one had 
occured against a NEWLY enrolled PIN. Many more were to 
follow; (See Table 6). These new PINs, with their 
corresponding 40 byte 'verification' templates in IBANK 
memory, were created under the most carefully scrutinized 
enrollment procedures. The thesis advisor witnessed the 
routine followed. The occurance of this particular Type II 
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DOT TABLE (6) TYPE II ERRORS- VERIFICATION ONLY 



0060- MALE 1, trying to match MALE 2, (old PIN 0025, new 
PIN 0071) 

false verification scores: . 60 .65 .61 .63 .64 .64-(0025) 

.67 .60 .64 .65 .64 .65 

.63 .64 .67 — ( 0071) 

15/58 = 25. 86% 15 scans out of 58 were false 
verifications. 



0025- MALE 2, trying to match MALE 1, (old PIN 0060, new 
PIN 0069) . 62 ( 0060) 

false verification scores of: . 64 .60 .62 .63 .65 -(0069) 

. 62 

7/44= 15. 91% 7 scans out of 44 were false verifications. 



0063- FEMALE 1, trying to match FEMALE 2, (old PIN 0067, 
new PIN 0072) 

false verification scores of:l(.60) 4(.61) 5(.62) 2(.63) 

4(.64) 1(.65) (0067) 

5(.60) 3(.61) 2(.62) 6(.63) 2( . 64) 3(.65) 1( . 66 ) — ( 0072 ) 

39/59 = 66. 10% 39 scans out of 59 were false 
verifications. 



0067-FEMALE 2, trying to match FEMALE 1, (old PIN 0063, 



new PIN 0070) 

NONE ( 0063) 

false verification scores of: .61 .63 .61 (0070) 



3/11= 27. 28% 3 scans out of 11 were false verifications 
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VERIFICATION error seemed to eliminate improper enrollment 
procedures as a cause for all the false acceptances. Also 
on that same date, a FIFTH Type II error under the RECOGNIZE 
mode happened when on the fifth of six trials, PIN 0060 was 
again incorrectly recognized as PIN 0025, with a correlation 
score of +0. 63. ALL FIVE TYPE 11 RECOGNITION ERRORS OCCURED 
ON THE DOT 1.5 , with the motion simulator activated. 

Initially^ these tests had not been performed on the 
DAISY 7. 5 because NO false recognitions occured during 
normally scheduled simulator motion testing. Upon request 
from the Eye-Dentify company of Beaverton Oregon, identical 
experimentation was completed on the DAISY scanner. The 
reason they were requesting this continuation of testing, 
was to determine if the numerous Type II verification errors 
that were consistently occuring to these four subjects, only 
on the DOT 7. 5 along with five false recognitions, were 
caused by a defective camera. Internal feedback from the 
dot's hardware or software was also considered. This might 
have created poor enrollment templates. 

If identical FALSE recognitions/ verifications on 
the DAISY scanner were to prevail, this might disprove their 
theory, or at least make them test much more extensively. 
CROSS TALK, a coding system used by the company on all their 
machines was found to be correct in the DOT machine. The 
value was +0. 044, which was stenciled in its internal 
cabinet. This number matched the value displayed on the 
terminal monitor when the command (Control-K) was input 
along with a password when at the main menu listing on the 
monitor. The cross talk value for the DAISY was +0. 060, but 
no value was found stenciled inside the cabinet to compare 
with. 



All four subjects were enrolled a second time on 27 
NOV 1985 into DAISY 7. 5 bubble memory. The same requirement 
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of keeping the older templates in memory in addition to 
these newly created ones was followed. The VERIFY threshold 
was at +0. 60, a constant that did not change throughout all 
testing. Cross checking of the two males and two females was 
completed in the same manner that prevailed with the DOT 
7. 5. There was no reason to cross check male to female, 
because no connection was evident. Out of curiosity, a few 
female to male cross checks were attempted. Resultant 
correlation scores were well below +0. 45( +0. 00 - +0.45). 
Testing under male/male, female/female conditions, provided 
the results listed in Table 7. 

For Table 7, MALE 1(0060) is represented by 
PIN' s( 0060,0028). MALE 2(0025) is represented by 
PIN' s( 0025,0072). FEMALE 1(0063) is represented by PIN's 
(0063,0071). FEMALE 2(0056) is represented by PIN's 
(0056,0070). The first PIN (0, ) is the older enrollment, 
the second PIN ( ,N) the newer. 

Male subject 0060 was scanned more than any 
other, three hundred and thirty eight(338) instances, because 
of consistent scores in the "fifties" (+0.50 - +0.59). At 
one point, the system operator turned off all the lights in 
the laboratory to see if that would assist 0060 in getting a 
false verification by matching 0025. Although it did seem to 
help when focusing in on the daisy wheel pattern, there were 
no pronounced changes in correlation scores. Additionally, 
the day before 0060 had 'enrolled' his second time, the PIN 
being 0072. He was able to correctly identify against this 
NEW PIN of his quite easily, but was unable to match when 
verifying against his own OLD PIN 0060 created two weeks 
earlier. The attempts were made over a two hour time 
duration. Apparently the night before 0060 received only 5. 5 
hours of sleep and stated he had been tired all day. The 
following morning, 0060 repeated the same procedure after a 
normal nights sleep and was identified against his OLD PIN 
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DAISY TABLE(7) TYPE II ERRORS- VERIFICATION ONLY 



0060- MALE 1 trying to match MALE 2, (old PIN 0025, 
new PIN 0072) 

false verification scores: ,60 --(0025) NONE (0072) 

1/338= 0.29% 1 scan out of 338 was a false verification. 
128 out of the 338 (37.87%) scans cross referencing 
PIN 0060 against PIN 0025 had scores in the range of 
(.50 -.59). The ave. was +0,534. There were 0 in this 
range for the eleven scans cross referenced against new 
PIN 0072. The average correlation score for the new PIN 
was +0.32, with two highs of +0.49. 

0025- MALE 2 trying to match MALE 1, (old PIN 0060, 
new PIN 0028) 

false verification scores: NONE (0060) (0028) 

0/28 = 0. 00% 0 scans out of 28 were false verification 
The highest correlation score was +0. 53 occuring once. 



0063-FEMALE 1 trying to match FEMALE 2, (old PIN 0056, 



new PIN 0070) 

false verification scores: .61 (0056) 

. 60 — ( 0070) 



2/25 =8% 2 scans out of 25 were false verifications. 

There was a gap of four NOT VERIFIED scans, 
before the second Type II error was recorded. 
She also had 3 scans in the "fifties". 

0056- FEMALE 2 trying to match FEMALE 1, (old PIN 0063, 
new PIN 0071) 

false verification scores: NONE ( 0063 )( 0071) 

0/31=0% Zero scans out of 31 were false verifications. 
Her highest correlation score was +0. 31. 
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with consistent scores in the nineties( +0. 90 - +0.99). This 
implies a possible connection between FATIGUE and being 
acknowledged by the Eye-dentify 7.5. 

There were FIVE mi sRECOGMITIONS (Type II) out of 
934(0.535%) recognition scans for this 
experiment( . 67 , . 63 , . 63 , . 61 , . 60 ) on the DOT 7.5. There were 
SIXTY- FOUR misVERIFICATIONS (Type II) out of a total of 172 
verification attempts utilizing the DOT 7. 5 which computes 
to 37.21%. There were THREE mi sVERIFICATIONS (Type II) out 
of a total of 422 verification attempts utilizing the DAISY 
7. 5 which computes to 0. 71%. There were ^ misRECOGNITIONS 
on the DAISY. One can see that there was a great disparity 
in the number of false VERIFICATIONS( Type II) on the DAISY 
7.5 ( 3 ) versus the DOT 7.5 (^) , when cross checking 
between the four subjects. Those three (3 out of 422) imply 
quite a lot though. If none had occured, then one might have 
surmised that the reason for so many false verifications on 
the DOT 7. 5 was defective hardware/software ( and/or) that 
the particular machine was possibly a 'lemon'. 

Another reason might be that the DOT may create more 
accurate/defined signature templates, because the three 
dimensional dot/cone alignment method seems to have proven 
its superiority over the two dimensional daisy pattern. The 
proof being earlier listed results. This allows subjects to 
enroll under better conditions. When cross checking is done 
in VERIFICATION mode, one on one, the different templates 
relating to the paired individuals have a greater likelihood 
of matching up. Although few in number, the occurance of 
those THREE false VERIFICATIONS on the DAISY implied that 
there WERE eye pattern similarities between these four 
specific individuals. Two of the three matches occured in 
the female/female link. One on the old PIN 0056, one on the 
new PIN 0070. The remaining misverif ication obviously 
related to the male/male matching, and was tied to the old 
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PIN 0025. Future research could investigate whether 
subjects of the same sex have a greater chance of matching 
up against one another. 

It must be noted that no other Type II 
RECOGNITION/VERIFICATION errors have occured on these 
particular machines from APR 1985 to the present. The 
machines have been in the Man-Machine Laboratory( Root Hall 
107) Naval Postgraduate School, Monterey, California, 
undergoing testing on a continuing basis. If the number(5) 
of Type II RECOGNITION errors were evaluated over the entire 
timeframe that the DOT 7.5 has been tested at the USNPGS, 
the Type II false recognition rate would be significantly 
lower. All rates presented in this work are a result of this 
specific thesis experiment only. 



B. OTHER OCCURANCE S/FORMULATIONS 

The highest correlation score relating to the verify and 
recognize Type II errors of this experiment was +0.67. 
Raising the lower identification threshold limit that the 
CRT lock manager sets, from the present +0. 60, to possibly 
+0. 70 WOULD INSURE THAT THESE FALSE ACCEPTANCES WOULD HAVE 
NEVER HAPPENED (±0.20 > ±0.^). A spokesman from Eye- 
dentify Inc. stated that they were in the process of 
revising their policy of not allowing the correlation 
threshold to ever be set below +0. 71 for this reason. A 
negative aspect of this policy would be increased queue time 
because correctly RECOGNIZED/VERIFIED scores in the +0. 60- 
+0.70 range would now be treated as unacceptable( NOT 
RECOGNIZED) by the 7.5, requiring additional eye scans that 
take more time. 

A theory was formulated after consultation with Eye- 
dentify Inc. that dealt with enrollment procedures. It was 
thought that accepting only very high enrollment correlation 
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scores( +0. 90 - +0.99) might have a negative effect on the 
digitized waveform that is processed and stored as the 
signature template. This waveform is created from reflected 
light generated from the beam of the ultra- low infrared 
light during the scanning process. This theorized negative 
effect was mentioned as a possible cause of recurring Type 
II errors. In response, all sixty original enrollees were 
entered into the system under the same stringent conditions 
of accepting only enrollment scans in the 'nineties'. This 
policy MET the requirements of the user's manual: "that the 
five enrollment scans taken should average at least +0.90. " 
No deviations were ever allowed. 

In addition, the swapping of template data located in 
the bubble memories of the DOT and DAISY was considered. 
This to assist in determining the cause of the Type II 
errors 'only' occuring on the DOT 7.5. Refer to Table 7 for 
DAISY Type II error figures i. e. , (3 out of 422). The 
procedure was to 'download' the eye templates from DOT 
bubble memory to floppy disk using the ' BACK IB BASIC ' 
language program and then 'upload' to DAISY bubble memory. 
Tests would be run and then the procedure reversed. The four 
subjects would try to get false acceptances in both modes. 
It was never done because in the interim, the three false 
verif ications( +0. 61 , +0. 60, +0. 60 ) occured on the DAISY. This 
enhanced the belief that some similarities between eye 
patterns were evident and that the identification threshold 
coefficient would have to be permanently raised to decrease 
the probability of recurrent Type II errors. 

A floppy disk that stored the hexadecimal values of the 
eye pattern templates belonging to the four (Type II) error 
subjects was forwarded to the Eye-Dentify Co. , Oregon. They 
were able to investigate and compare signatures to the 
bit( binary digit-0,1) level, to ascertain how similar the 
eye patterns actually were. Verbal reports to the thesis 
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advisor indicate there WERE similarities in the 
patterns. 



eye 
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IV. COSTS /BENEFITS 



The cost of the Eye-dentify 7. 5 retinal biometric 
scanner is $10,000.00 as of January 1986. No other firm 
manufactures such a product and the U. S. military does not 
own or maintain this type of device aboard ship. They are 
now being tested by research facilities like the Naval 
Postgraduate School for possible future uses by the 
Department of Defense. Because there is a lack of 
competition presently between manufacturers, its price is 
relatively expensive. As more competitors join this market 
though, a lower equilibrium price should eventually be 
attained for retinal scanner hardware. The software needed 
for a shipboard computer system interface would depend on 
the size of the application required. No specific price is 
available, because retinal scanner applications have not 
been developed for shipboard use. As technology is 
developed though, and as all retinal biometry applications 
are perfected, this price should decrease also. Numerous 
examples of products from the computer and electronics 
industry can be cited to support this claim. The most 
profound is the advent of microcomputers. When the LISA 
business office system was first introduced by Apple 
Computer Inc. of Cupertino, California, the price was 
$10,000.00. In a very short time prices were drastically 
cut(more than a third). This was due to intense competition 
and a lack of market interest in the LISA. Eventually it was 
discontinued as a production item. 

As Research and Development( R+D) costs are distributed 
by increasing competition and amortized over increased sales 
revenue in retinal scanners, the unit cost of each machine 
should decrease, making the system increasingly affordable 



52 



and attractive. The U. S. Government is usually the first 
buyer of this type of equipment in large amounts. This 
allows the private sector to study its successes/failures 
through government use before they have to buy in any 
quantity. 

1. Applications 

Some obvious applications aboard ship would be 
security and access control. An example mentioned earlier, 
would be to locate a retinal scanner at the main entrance to 
the nuclear propulsion space on either an aircraft 
carrier( CVN) , surface combat ant ( CGN) or a 
submarine( SSN/SSBN) . The scanner would have its own battery 
backup for emergency power generation should there be a loss 
of the ship's electrical load. If it was decided that the 
scanner alone would not provide adequate security, a 
password system or cipher lock could be used in parallel 
with the scanner. This 'double protection' system has more 
distinct advantages than a cipher lock or password system 
alone. A disadvantage to consider is the additional time 
required to successfully gain access to a system guarded 
with 'double protection'. 

2. Shortcomings 

Cipher lock combinations can be compromised, as can 
passwords, I.D's etc. Human retina, choroid and blood 
vessel patterns are not, as long as the database manager( CRT 
lock) is honest and proficient. This manager(s) is the only 
person(s) with the capability to circumvent via the 
manipulation of parameters, or by enrolling someone that 
does not have authorization. The key difference is, with 
passwords everyone with access must MEMORIZE it, thereby 
having the ability to give the password to someone else. 
With retinal scanning, although you may have access, you 
cannot give someone else your eye signature template stored 
away in bubble memory. 
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Common shortcomings of passwords regarding the 
security of a computer system , especially with the advent 
of 'hackers', is the ability to control the dissemination of 
the password and the need to constantly change it. The use 
of retinal identification alleviates this need because the 
scanner operates as a secure stand alone system and can also 
be installed as a network of units reporting to a host 
computer. ( Eye-Dentify, 1985) It could be used to simplify 
the logon procedure for a computer user. Instead of typing 
the user ID and access code, the user simply scans and gets 
logged on automatically. 

Certain systems needing enhanced security might only 
require a retinal scanner by itself, while others may need 
double protection provided through 'paralleling'. Another 
option to consider if 'paralleling' is not feasible, is the 
use of one machine in the dual eye mode, i. e. , (one subject 
scanning BOTH left and right eyes simultaneously). The DAISY 
has this option, the DOT does not. Also, two machines can 
be modified so that the correct identification of two 
DIFFERENT subjects is necessary to allow access. This 
technology would be ideal for two person control of very 
sensitive functions. Envision two separate 7.5's to be used 
by watch officers in a missile silo to scan in sequence 
before their system could be activated. 

In June of 1981, Columbia Broadcast System(CBS) news 
aired a multi-faceted evening documentary titled. The 
Defense of the United States . In one episode, viewers were 
given the chance to explore the realm of a watch station in 
a nuclear missile silo. The officers on duty had certain 
procedures to be followed should they ever receive the order 
from the President, to follow through with what they were 
trained to do. It would seem reasonable that, with the use 
of a retinal scanner in parallel with existing activation 
procedures, this would enhance security. This would occur 
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because there would be a reduction in the probability that 
an imposter or crazed watchstander could successfully breach 
all authentication procedures( now to include a retinal 
scanner), gain access and launch. 

To estimate the total cost of this specific piece of 
HARDWARE and needed peripherals for a 600 ship Navy and 
selected Coast Guard vessels is beyond the scope of this 
thesis. Some ships would require more retinal scanners 
because the equipment they store and the information they 
process warrants it. Large amounts of secure information are 
handled, high level communication and computer equipment 
must be guarded, nuclear spaces protected etc. , therefore 
more scanners are needed. Fewer scanners need to be 
installed where the mission of the vessel does not include 
the storage/dissemination of VAST amounts of high level 
secure information, equipment or computers. 

A ship classification hierarchy based on security 
requirements would need to be developed to determine how 
many scanners each would be allocated. Possible groupings 
would include: all nuclear powered combatants and 
conventional aircraft carriers( CVN, CV, SSN, SSBN, CGN) , 
conventionally powered combatants large(CG,DD) and 
small(DDG,FF,FFG), the auxiliary f orce( AO, AOE , AFS , AOR, AE ) . 
Others are the amphibious force large( LHA, LPH, LKA) and 
small( LST, LSD, LPD) , command and control( LCC, MSC) , 
battleships( BB) and support tenders (AD,AR,AS). Coast Guard 
cutter groupings would be High Endurance Cutters( WHEC) , 
Medium Endurance Cutter s( WMEC) and Icebreakers( WAGB ) . 

Additional costs would include needed maintenance 
beyond contracted warranty. Also application software costs 
for the particular requirements at hand, would be quite 
considerable. 
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V. CONCLUSIONS 



In general, the use of this device is ONLY acceptable 
when the physical security of the space will preclude access 
via any other means. Cost is always a consideration. It 
would appear a fairly minor one in this instance, given the 
sensitive data, information and equipment a scanner would 
assist in protecting. This opinion is enhanced by the 
recent spying cases under investigation throughout the 
United States Navy and other government agencies. A recent 
Navy spy case involves a Navy civilian counterintelligence 
analyst, and his wife. He for allegedly spying for our ally 
Israel, and his wife charged with relaying top secret data 
to Red China. Non-Navy employees arrested include a man who 
was convicted of selling CIA information to Chinese 
intelligence agents for more than thirty years. Another man 
is charged with delivery and attempting to deliver national 
defense documents to an adversary. One document was a 
transcript of a hearing of the House Armed Services 
Committee classified as top secret. 

The need for enhanced security is understandable. It 
must be noted though, that with retinal biometrics along 
with the other biometric devices( fingerprint, palmprint, 
finger length etc. ), the human element is still relied upon. 
Human systems cannot be considered infallible when a CRT 
database administrator is capable of being careless or 
dishonest when enrolling individuals. Money can still be 
used as a bribe to circumvent the system. With this system 
though, fewer individuals have access to controls which 
could make a difference. 
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A. USES ABOARD SHIP 



In an area aboard ship requiring maximum security, with 
a limited number of people requiring access IMMEDIATELY, the 
retinal biometric measuring device would be ideal. It should 
provide a more reliable method of identification than a 
photograph, ID, cipher or password because it cannot be 
compromised as readily. Its use could also be considered 
aboard ship, where the total access list is small to medium 
in number, immediate access is NOT so critical, and entry 
times are STAGGERED to alleviate the chance of a queue 
forming. During an alarm, certain individuals such as the 
commanding officer might have to bypass, if possible, for 
immediate access. The greater the number of subjects needing 
access to a space or system in a shipboard application, the 
greater the possibility that large queues might form. This 
would be counterproductive. 

Physical maintenance of the 7. 5 should not be a concern. 
The system is compact, and capable of being mounted on a 
table top or protruding from a bulkhead. It would be treated 
like any other valuable electronic equipment; located within 
the interior of the ship away from the elements, i. e. , 
salt/sea spray, extreme temperatures etc. . There would be a 
need for software maintenance as updates are needed. 

Although costs and benefits were discussed in the prior 
chapter, it was not a comprehensive investigation, but only 
a general overview. It is beyond the scope of this thesis to 
dissect the subject any further. An entire thesis could be 
dedicated to a cost/benefit analysis of installing retinal 
biometric scanners aboard U. S. Navy ships and Coast Guard 
cutters. 

Retinal scanners should become commonplace in future 
years. Individuals will want to know the long term effects 
of exposure to the infrared light. Although Threshold Limit 
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Testing(TLV) has shown the effect to be harmless, many will 
still continue to be concerned. 
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